CVE-2026-63296

{
  "id": "CVE-2026-63296",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T20:17:47.437",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autorización en LXD permite a un atacante autenticado omitir las restricciones del proyecto de destino durante la migración de instancias. Al migrar una instancia a un proyecto de destino, LXD acepta anulaciones de configuración sin validar la nueva configuración contra las restricciones impuestas por el proyecto de destino. Un atacante puede explotar esta falla para mover instancias con configuraciones de alto privilegio no permitidas a proyectos restringidos, omitiendo los controles de seguridad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Canonical",
          "product": "LXD",
          "defaultStatus": "unaffected",
          "packageName": "LXD",
          "platforms": [
            "Linux"
          ],
          "repo": "https://github.com/canonical/lxd",
          "versions": [
            {
              "version": "5.0.0",
              "lessThan": "5.0.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.21.0",
              "lessThan": "5.21.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0",
              "lessThan": "6.10",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T14:25:15.629982Z",
          "id": "CVE-2026-63296",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.0.8",
              "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.1",
              "versionEndExcluding": "5.21.6",
              "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.10",
              "matchCriteriaId": "374F5622-1D8F-4EF9-97E6-736C8220623B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Exploit",
        "Mitigation"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory",
        "Exploit",
        "Mitigation"
      ]
    }
  ]
}